1. Field of the Invention
The present invention relates to a method and apparatus for classifying traffic at transport layer, and more particularly, to a method and apparatus for classifying traffic easily and also accurately by identifying the application service of traffic with only statistical data of traffic at transport layer.
2. Description of the Related Art
Recent explosive development of internet over decades has brought about dramatic development of traffic. Accordingly, classifying and analyzing traffic has been an important issue for providing resources and developing applications.
Typical two methods to classify traffic are a port number based method and a payload content based method. Traditionally, identification of application has been carried out by a port number since most of applications use static port numbers. However, many of new P2P applications allot random port numbers. Furthermore, many of existing applications using a C&S model tend to allot random port numbers. The random allotment complicates identifying applications by port numbers.
According to the content based method, the whole or specific part of payload content is examined to identify applications. This method identifies applications accurately. However, this method requires a big storage and is complicated in finding a signature and mapping. At the same time, this method has problems in scalability and protecting contents. If there is no signature or if data are encrypted, the method cannot identify applications, even if there are enough resources. For example, in case of game services, most of game protocols are not open to the public, so that it is difficult to find a signature of the relevant application. Therefore it is difficult to identify game applications by the content based method.